Belkin F5D8635-4v1

There are many different versions for the Belkin F5D8635 with different hardware, and it seems that not even same versions have the same hardware. This page is for the one that has a Danube soc, not the Amazon one.

There are 71 sectors, the first 8 sectors(mtd0) have a size of 8KiB(0x2000) each and the remaining 63 sectors(mtd1) have a size of 64KiB(0x10000) each

Either the backup I did was erroneous or fwdiag, calibration and voip partitions are filled with 1s, that is the hex dump just shows FF which means they are empty.

From the binary dump I can say:

uboot datablock has data from 0x0 to 0xD66D.

rootfs datablock has data at the end, from 0x4B120 to 0x4D89F. It's not clear if there is anything useful in here.

kernel datablock has data from 0x4D8A0 to 0x3F4FFF (It is full). The start address matches an uImage header which is followed by LZMA compressed data. Inside there is a squash filesystem named ramdisk.

sysconfig datablock has data from 0x3F5000 to 0x3F6FE2 which is in gzip format. When uncompressed there are plain text settings and most of them just refer to wan, lan, wi-fi, MAC and vlan.

ubootconfig datablock has data from 0x3F9000 to 0x3F9BFF which contains the U-boot environment

fwdiag, calibration and voip are empty

Access

The router has telnet and is enabled by default. It can also be accessed from serial and EJTAG.

Telnet

Telnet the router ip and login to admin user with the same password of the web based interface

Connect the usb to the computer and make sure that checksums of the same mtd partition match, otherwise try doing a backup again:

$ md5sum mtd0.bin mtd0_compare.bin

Make sure that checksums of mtd0.bin and mtd0_compare.bin match

$ md5sum mtd1.bin mtd1_compare.bin

Make sure that checksums of mtd1.bin and mtd1_compare.bin match

(Optionally)Concatenate both dumps:

$ cat mtd0.bin mtd1.bin > full_backup.bin

Proposed Partition Layout

Layer 2 (OpenWRT)

uboot

firmware

uboot_env

Start
End

0xB0000000
0xB0010000

0xB0010000
0xB03F0000

0xB03F0000
0xB0400000

Size

0x10000

0x3E0000

0x10000

Size

64 KiB

3.875 MiB

64 KiB

Layer 1 (U-boot)

[0]uboot

[1]rootfs

[2]kernel

[3]sysconfig

[4]ubootconfig

[6]fwdiag

[7]calibration

[5]voip

Start address

0xB0000000

0xB0010000

0xB004D8A0

0xB03F5000

0xB03F9000

0xB03F9C00

0xB03F9E00

0xB03FA000

Size

0x10000

0x3D8A0

0x003A7760

0x4000

0x0C00

0x0200

0x0200

0x6000

Size

64 KiB

246.15 KiB

3.65 MiB

16 KiB

4 KiB

512 B

512 B

24 KiB

Partitions must have as a minimum the size of a sector. It is 0x10000 except for the first 0x10000 block which is 0x2000.

Bootloader

It is very dangerous to flash a bootloader image without having UART mode(recovery) access. Once there is a working image, modifying the original bootloader environment(kernel_addr variable) so it boots from 0xB0010000 can be done as follows: